From: Eyal Birger <eyal.birger@gmail.com>
To: steffen.klassert@secunet.com
Cc: davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
netdev@vger.kernel.org, monil191989@gmail.com,
nicolas.dichtel@6wind.com, stephen@networkplumber.org,
Eyal Birger <eyal.birger@gmail.com>
Subject: [PATCH ipsec,v2] xfrm: fix "disable_policy" on ipv4 early demux
Date: Sun, 9 Oct 2022 22:16:43 +0300 [thread overview]
Message-ID: <20221009191643.297623-1-eyal.birger@gmail.com> (raw)
The commit in the "Fixes" tag tried to avoid a case where policy check
is ignored due to dst caching in next hops.
However, when the traffic is locally consumed, the dst may be cached
in a local TCP or UDP socket as part of early demux. In this case the
"disable_policy" flag is not checked as ip_route_input_noref() was only
called before caching, and thus, packets after the initial packet in a
flow will be dropped if not matching policies.
Fix by checking the "disable_policy" flag also when a valid dst is
already available.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216557
Reported-by: Monil Patel <monil191989@gmail.com>
Fixes: e6175a2ed1f1 ("xfrm: fix "disable_policy" flag use when arriving from different devices")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
----
v2: use dev instead of skb->dev
---
net/ipv4/ip_input.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 1b512390b3cf..e880ce77322a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -366,6 +366,11 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
iph->tos, dev);
if (unlikely(err))
goto drop_error;
+ } else {
+ struct in_device *in_dev = __in_dev_get_rcu(dev);
+
+ if (in_dev && IN_DEV_ORCONF(in_dev, NOPOLICY))
+ IPCB(skb)->flags |= IPSKB_NOPOLICY;
}
#ifdef CONFIG_IP_ROUTE_CLASSID
--
2.34.1
next reply other threads:[~2022-10-09 19:17 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-09 19:16 Eyal Birger [this message]
2022-10-10 8:28 ` [PATCH ipsec,v2] xfrm: fix "disable_policy" on ipv4 early demux Nicolas Dichtel
2022-10-10 10:29 ` Eyal Birger
2022-10-10 12:19 ` Nicolas Dichtel
2022-10-10 12:52 ` Eyal Birger
2022-10-10 13:15 ` Nicolas Dichtel
2022-10-14 13:37 ` Steffen Klassert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221009191643.297623-1-eyal.birger@gmail.com \
--to=eyal.birger@gmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=monil191989@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=pabeni@redhat.com \
--cc=steffen.klassert@secunet.com \
--cc=stephen@networkplumber.org \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).